K8S port forward to Service in secure cluster

user_4802676 0
Viewed 394

From past 1 year we are working on K8S environment where each user has the access to all namespaces. But as we are introducing new applications in cluster it is important to grant only required access to a user .

We have few services which runs in a namespace e.g. ABC. As there were no restrictions users were able to port forward the service and access it. With new restrictions now they are not able to access those services.

Is there a way to grant access to users for port-forward which will not compromise the security ?

portforwarding kubernetes
1 Answers

What you need is called RBAC.

Role-based access control (RBAC) is a method of regulating access to computer or network resources based on the roles of individual users within your organization.

RBAC authorization uses the rbac.authorization.k8s.io API group to drive authorization decisions, allowing you to dynamically configure policies through the Kubernetes API.

RBAC auth rules are configured with K8s resources which can be placed in two groups:

  • Role and ClusterRole contains rules that represent a set of permissions, it specify which actions can be performed on which resources, if you want to define a role within a namespace, use a Role, if you want to define a role cluster-wide, use a ClusterRole. More about it here.

  • RoleBindings and ClusterRoleBindings binds above role and ClusterRole to specific list of subjects(users,groups,service accounts). A RoleBinding grants permissions within a specific namespace whereas a ClusterRoleBinding grants that access cluster-wide. More about it here.

There is an example Role and RoleBinding for kubectl port-forward from this tutorial.

To take this example even further, let’s say that you want to give a person access to only port-forward. You will have to create an RBAC role that lets this person only do this:

kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  namespace: my-namespace
  name: allow-port-forward
rules:
- apiGroups: [""]
  resources: ["pods", "pods/portforward"]
  verbs: ["get", "list", "create"]

This sets up a role in the namespace my-namespace and allows this role to get, list, and create on pods and pods/portforward. These are all of the permissions needed to allow someone to port-forward. This person will be able to list the pods in this namespace. Then you bind this role to a user:

apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: allow-port-forward
  namespace: my-namespace
subjects:
- kind: User
  name: bob
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: Role
  name: allow-port-forward
  apiGroup: ""

This will give the user bob the rights to perform the above actions in the namespace my-namespace

So the answer here would be to add add rbac auth rules for every user which should be able to use kubectl port-forward.

user_119777600
Related